docs: Tailscale SSH ACL set to accept

Tailnet SSH policy changed from the default action:"check" to accept. The
effective policy is now a single rule covering all tailnet nodes, with no
expiry and port forwarding allowed, so the per-device ~12h grants and the
browser re-auth prompt are gone.

Verified unattended with BatchMode=yes: a plain command, a -L forward
returning HTTP 302, and the Herdr fallback leg.

Records the trade-off: check acted as a second factor, so a compromised
tailnet device now reaches root on Unraid without a further step.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/09-TAILSCALE-VPN.md

@@ -262,10 +262,15 @@ ssh root@xtrm-unraid.tailf789e1.ts.net
 ssh -N -L 18089:127.0.0.1:80 root@100.100.208.69
 ```
 
-The default tailnet ACL uses `action: "check"`, so the first connection in each
-period opens a browser re-auth prompt. Fine interactively, but it will stall an
-unattended tunnel; switching that rule to `accept` for `autogroup:self` in the
-admin console removes the prompt.
+The tailnet SSH ACL was switched from the default `action: "check"` to
+`accept` on 2026-11-03, so this needs no browser re-auth and works unattended.
+Before the change the policy minted ~12 h grants per device and prompted when
+they lapsed. The effective policy is now a single rule: accept for all tailnet
+nodes, with local and remote port forwarding and agent forwarding allowed.
+
+The trade-off: `check` acted as a second factor, so a compromised tailnet device
+now reaches root on Unraid without a further step. Acceptable here because every
+node in the tailnet is the owner's own hardware.
 
 ### The other path — via the MikroTik subnet router